CVE-2021-31761

🗓️ 25 Apr 2021 18:30:40Reported by mitreType

cve

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 130 Views🌐 WEB

Webmin 1.973 reflected XSS leads to RC

Reporter	Title	Published	Views	Family All 16
0day.today	Webmin 1.973 - (run.cgi) Cross-Site Request Forgery Vulnerability	20 Jul 202100:00	–	zdt
GithubExploit	Exploit for Cross-site Scripting in Webmin	21 Apr 202120:00	–	githubexploit
GithubExploit	Exploit for Cross-site Scripting in Webmin	21 Apr 202119:46	–	githubexploit
ATTACKERKB	CVE-2021-31761	25 Apr 202119:15	–	attackerkb
Circl	CVE-2021-31761	25 Apr 202110:27	–	circl
CNNVD	Webmin 跨站脚本漏洞	25 Apr 202100:00	–	cnnvd
CNVD	Webmin cross-site scripting vulnerability (CNVD-2021-31909)	26 Apr 202100:00	–	cnvd
Cvelist	CVE-2021-31761	25 Apr 202118:30	–	cvelist
Exploit DB	Webmin 1.973 - 'run.cgi' Cross-Site Request Forgery (CSRF)	20 Jul 202100:00	–	exploitdb
NVD	CVE-2021-31761	25 Apr 202119:15	–	nvd

NVD

Node

webmin webminMatch1.973

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/163559/Webmin-1.973-Cross-Site-Request-Forgery.html
youtu	www.youtu.be/23VvUMu-28c
github	www.github.com/webmin/webmin
github	www.github.com/electronicbots/CVE-2021-31761
github	www.github.com/Mesh3l911/CVE-2021-31761

Parameter	Position	Path	Description	CWE
cmd	request body	/proc/run.cgi	Reflected CSRF/XSS to trigger RCE through Webmin's run.cgi endpoint	CWE-79
mode	request body	/proc/run.cgi	Reflected CSRF/XSS to trigger RCE through Webmin's run.cgi endpoint	CWE-79
user	request body	/proc/run.cgi	Reflected CSRF/XSS to trigger RCE through Webmin's run.cgi endpoint	CWE-79
input	request body	/proc/run.cgi	Reflected CSRF/XSS to trigger RCE through Webmin's run.cgi endpoint	CWE-79
undefined	request body	/proc/run.cgi	Reflected CSRF/XSS to trigger RCE through Webmin's run.cgi endpoint	CWE-79

17 Jun 2026 03:52Current

8.9High risk

Vulners AI Score8.9

CVSS 26.8

CVSS 3.19.6

EPSS0.33569

webmin 1.973 reflected xss rce cve-2021-31761 nvd